[eng-cve-remediation-app]

This PR contains the following updates:

Package	Type	Update	Change
org.clojure:clojure	dependencies	security	1.11.2 → 1.12.3

Target versions follow this repo's configured version reference, not the lowest release that fixes the vulnerabilities.

Dependency path

• puppetlabs:i18n → org.clojure:clojure

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity	CVSS Score	Vulnerability
High	7.5	CVE-2024-22871
Critical	9.8	CVE-2017-20189

---

Bump strategy

org.clojure:clojure bump

• Direct dependency, declared inline in project.clj (:dependencies vector).
• The repo's committed project.clj already had clojure at 1.11.2 (ahead of
  the unit's recorded current_version of 1.8.0), which already resolves
  CVE-2024-22871 and CVE-2017-20189.
• This unit is reference_aligned: true, so the target is the repo's version
  reference's pinned clojure release (1.12.3), not merely "any fixing
  version." Bumped 1.11.2 -> 1.12.3.
• lein deps resolves cleanly against the new version; no other dependency
  needed adjustment.

[eng-cve-remediation-app]

🔎 Dependency bump analysis

Breaking changes: false · Reachability: no

---

Impact report

Changelog Impact Report: org.clojure/clojure 1.11.2 → 1.12.3

Summary

This PR bumps org.clojure/clojure in project.clj from 1.11.2 to 1.12.3
(single line change, no other dependencies touched). Verdict: not breaking.
Both CVEs that originally triggered remediation (CVE-2024-22871, fixed in 1.11.2;
CVE-2017-20189, fixed in 1.9.0) were already resolved before this bump — the
repo's current_version baseline in this PR (1.11.2) already contains both
fixes. This bump is a routine catch-up to the latest Clojure 1.12.x patch
release, not new CVE remediation. Reviewed all intermediate releases (1.11.3,
1.11.4, 1.12.0, 1.12.1, 1.12.2, 1.12.3); no breaking changes apply to this
repo's usage.

Why this bump happened

unit.json reports the CVE scan baseline as 1.8.0 → 1.12.3, but the actual
working-tree diff (bump-diff.txt) only moves 1.11.2 → 1.12.3. This means
an earlier PR (#24, already merged per git log) had already remediated both
CVEs by bumping to 1.11.2. This PR is simply advancing to the latest 1.12.x
release line on top of that.

CVE	Severity	Fixed in	Status at current_version (1.11.2)
CVE-2017-20189	CRITICAL (9.8)	1.9.0	Already fixed
CVE-2024-22871	HIGH (7.5)	1.11.2	Already fixed

Diff analyzed

-                 [org.clojure/clojure "1.11.2"]]
+                 [org.clojure/clojure "1.12.3"]]

Only project.clj changed. No other manifest, lockfile, or sibling dependency
was touched. puppetlabs/i18n "0.4.3" and the dev-only
org.apache.commons/commons-lang3 "3.4" are unaffected and unrelated to this
bump — no cohort/family-split concern here (Clojure isn't part of a matched
BOM/sibling set in this project).

/tmp/release-notes.md was empty, so this report is based on upstream
clojure.org / cljdoc changelogs (see References).

Upstream changes, by version

Version	Notable changes	Breaking?
1.11.3	Compatibility fix for Java 21's new Thread/sleep 1-arity overload	No — bug fix
1.11.4	Maintenance release	No
1.12.0	New Java interop: method values (Classname/staticMethod, Classname/new), functional-interface argument coercion, array class symbols, new clojure.java.process namespace, new library-add-at-runtime functions. Internal: lazy-seq/delay switched from synchronized blocks to locks (fixes virtual-thread pinning on JDK 21+). Var interning policy tightened (redefining a var interned in a different ns without ns-unmap first now throws/rejects instead of silently allowing it). Still compiles to Java 8 bytecode — announcement notes 1.12 is the last release on a Java 8 baseline, but no runtime bump in this release. clojure.java.process/capture (added in a 1.12 alpha) was removed before/at final release.	Only the var-interning tightening and clojure.java.process/capture removal are plausibly breaking, and neither applies here (see below)
1.12.1	Reverted a 1.12.0 semantic change to qualified-symbol invocation; gen-class updated to support new array-class syntax	No — net revert of a 1.12.0 change
1.12.2	Compiler/LazySeq serialization fixes; iterate's result no longer supports Java deserialization	No — narrow, affects only code that Java-serializes iterate lazy seqs
1.12.3	Patch release, no additional breaking items found	No

No minimum-runtime bump: Clojure 1.12.x still targets Java 8 bytecode, same as
1.11.x.

How we use it

This repo (puppetlabs/stockpile) is a small, self-contained Clojure library
(src/puppetlabs/stockpile/queue.clj) with no other first-party consumers in
this checkout. Checked the changed/notable surface against actual usage:

• clojure.java.process (new in 1.12, had a removed capture fn): not
  used anywhere in the repo. grep -r "clojure.java.process" → no matches.
  Tests use clojure.java.shell/sh instead (test/puppetlabs/stockpile/queue_test.clj:4,36),
  an unrelated, unchanged namespace. Not affected.
• Var interning policy tightening: queue.clj uses
  (:refer-clojure :exclude [reduce]) and defines its own reduce in its own
  namespace (src/puppetlabs/stockpile/queue.clj:1-2,213) — this is normal
  shadowing of a clojure.core var within one's own ns, not interning a var
  from a different namespace without unmapping, so the tightened check
  doesn't trigger. No other dynamic var redefinition patterns found in the
  codebase. Not affected.
• lazy-seq/delay lock implementation change: internal-only change,
  same observable API/semantics (improves JDK 21 virtual-thread behavior).
  queue.clj doesn't use delay; reduce-paths et al. use eager
  clojure.core/reduce over an iterator-seq, not lazy-seq. Not
  affected, and the change is a strict improvement if it were.
• iterate serialization change (1.12.2): repo doesn't serialize lazy
  seqs via Java serialization anywhere. Not affected.
• Java interop additions (method values, functional-interface coercion,
  array class symbols): purely additive; queue.clj already uses classic
  (Classname/staticMethod ...) / (.instanceMethod obj ...) interop forms
  throughout (e.g. src/puppetlabs/stockpile/queue.clj:21-30,65-79), which
  continue to work unchanged. Not affected, nothing to adopt or break.
• Java bytecode target: CI (.github/workflows/main.yml:12-15,27-32)
  already matrices JDK 8, 11, and 17 via dev/java-env; Clojure 1.12.x still
  targets Java 8 bytecode, so no CI or runtime changes are needed.

Action items / risks

• No action needed. The version bump is a one-line, low-risk patch-level
  advance. No stable public API used by this repo was removed, had its
  signature changed, or had its documented behavior altered in a way that
  requires code changes here.
• Optional/no-op: if this repo ever adopts clojure.java.process or Java
  serialization of lazy sequences in the future, revisit the 1.12.0/1.12.2
  notes above — but nothing in the current codebase triggers either.

References

• Clojure 1.12.0 release announcement
• Clojure 1.11.2 release announcement (CVE-2024-22871 fix)
• Clojure 1.11.3 release announcement
• cljdoc changelog — org.clojure/clojure 1.12.1
• cljdoc changelog — org.clojure/clojure 1.12.3
• Clojure Dev Changelog
• CVE-2024-22871: https://www.mend.io/vulnerability-database/CVE-2024-22871
• CVE-2017-20189: https://www.mend.io/vulnerability-database/CVE-2017-20189